@mmerterden/multi-agent-pipeline 11.4.0 → 11.5.0

package/pipeline/lib/fetch-crashlytics.sh

@@ -124,22 +124,40 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Firebase_Access_Json"
 
-SA_JSON_B64=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+SA_JSON_B64=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$SA_JSON_B64" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
 fi
 
 # The credential store may return raw JSON or base64-encoded JSON (the user's
-# setup convention). Try base64-decode first, fall back to raw.
+# setup convention). Try base64-decode first, fall back to raw. The decoded
+# payload contains a GCP private key, so it goes into a 0600 mktemp file with
+# cleanup traps registered BEFORE the secret is written.
+SA_TMP=""
+cleanup_sa_tmp() {
+  if [ -n "$SA_TMP" ]; then rm -f "$SA_TMP"; fi
+}
+trap cleanup_sa_tmp EXIT
+trap 'cleanup_sa_tmp; exit 130' INT
+trap 'cleanup_sa_tmp; exit 143' TERM
+SA_TMP=$(umask 077; mktemp "${TMPDIR:-/tmp}/fc-sa.XXXXXX")
+
 SA_JSON=""
-if printf '%s' "$SA_JSON_B64" | base64 -d > /tmp/.fc-sa-$$.json 2>/dev/null \
-   && python3 -c "import json; json.load(open('/tmp/.fc-sa-$$.json'))" 2>/dev/null; then
-  SA_JSON=$(cat /tmp/.fc-sa-$$.json)
+if printf '%s' "$SA_JSON_B64" | base64 -d > "$SA_TMP" 2>/dev/null \
+   && python3 -c "import json, sys; json.load(open(sys.argv[1]))" "$SA_TMP" 2>/dev/null; then
+  SA_JSON=$(cat "$SA_TMP")
 else
   SA_JSON="$SA_JSON_B64"
 fi
-rm -f /tmp/.fc-sa-$$.json
+rm -f "$SA_TMP"
+SA_TMP=""
 
 # Verify project_id from SA JSON matches the URL  -  protects against pasting a
 # crash URL from another GCP project than the keychain's SA covers.
@@ -235,6 +253,10 @@ if [ -z "$ACCESS_TOKEN" ]; then
   exit 3
 fi
 
+# Bearer auth via a curl config fed through process substitution so the token
+# never appears in argv (argv is visible to ps).
+crashlytics_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$ACCESS_TOKEN"; }
+
 # Construct the appId in the form Firebase expects:
 #   ios:   ios:<bundleId>   →  api: /projects/<n>/apps/<bundleId> (looked up via list)
 #   android: android:<package>
@@ -245,7 +267,7 @@ APP_REF="$PLATFORM:$BUNDLE"
 ISSUE_URL_API="https://firebasecrashlytics.googleapis.com/v1alpha/projects/$PROJECT_ID/apps/$APP_REF/issues/$ISSUE_ID"
 
 ISSUE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-  -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+  -K <(crashlytics_auth_cfg) -H "Accept: application/json" \
   "$ISSUE_URL_API" 2>/dev/null || true)
 
 if [ -z "$ISSUE_JSON" ]; then
@@ -257,7 +279,7 @@ SESSION_JSON=""
 if [ -n "$SESSION_ID" ]; then
   SESSION_URL_API="$ISSUE_URL_API/sessions/$SESSION_ID"
   SESSION_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-    -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+    -K <(crashlytics_auth_cfg) -H "Accept: application/json" \
     "$SESSION_URL_API" 2>/dev/null || true)
 fi
 

package/pipeline/lib/fetch-fortify.sh

@@ -128,7 +128,13 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Fortify_Access_Token"
 
-TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
@@ -153,8 +159,11 @@ fortify_get() {
     else
       hdr="Authorization: FortifyToken $(printf '%s' "$TOKEN" | base64 | tr -d '\n')"
     fi
+    # Auth header goes through a curl config via process substitution so the
+    # token never appears in argv (argv is visible to ps).
     resp=$(curl -sS --max-time "$TIMEOUT" --connect-timeout 5 -w "\n%{http_code}" \
-             -H "$hdr" -H "Accept: application/json" "$url" 2>/dev/null || true)
+             -K <(printf 'header = "%s"\n' "$hdr") \
+             -H "Accept: application/json" "$url" 2>/dev/null || true)
     http=$(printf '%s' "$resp" | tail -n1)
     if [ "$http" = "200" ]; then
       printf '%s' "$resp" | sed '$d'

package/pipeline/lib/fetch-swagger.sh

@@ -57,13 +57,21 @@ trap 'rm -f "$TMP_RAW"' EXIT
 # platform; we let curl run with --output then check the size).
 CURL_ARGS=(-sS --fail --max-time "$TIMEOUT" --connect-timeout 5 --location --output "$TMP_RAW" \
            --write-out "%{http_code}\n%{content_type}\n%{size_download}\n")
-if [ -n "${SWAGGER_AUTH_HEADER:-}" ]; then
-  CURL_ARGS+=(-H "$SWAGGER_AUTH_HEADER")
-fi
 
-if ! META=$(curl "${CURL_ARGS[@]}" "$URL" 2>/dev/null); then
-  echo "ERR: swagger fetch failed for $URL" >&2
-  exit 2
+# The optional auth header may carry a token, so it is fed through a curl
+# config via process substitution instead of argv (argv is visible to ps).
+swagger_auth_cfg() { printf 'header = "%s"\n' "$SWAGGER_AUTH_HEADER"; }
+
+if [ -n "${SWAGGER_AUTH_HEADER:-}" ]; then
+  META=$(curl "${CURL_ARGS[@]}" -K <(swagger_auth_cfg) "$URL" 2>/dev/null) || {
+    echo "ERR: swagger fetch failed for $URL" >&2
+    exit 2
+  }
+else
+  META=$(curl "${CURL_ARGS[@]}" "$URL" 2>/dev/null) || {
+    echo "ERR: swagger fetch failed for $URL" >&2
+    exit 2
+  }
 fi
 
 HTTP_CODE=$(printf '%s\n' "$META" | sed -n '1p')
@@ -88,7 +96,10 @@ case "$LOWER_CT" in
   *yaml*|*yml*) FORMAT="yaml" ;;
   *json*)       FORMAT="json" ;;
   *)
-    case "${URL,,}" in
+    # Lowercase via tr: the bash-4 case-conversion expansion is not
+    # available on macOS /bin/bash 3.2.
+    LOWER_URL=$(printf '%s' "$URL" | tr '[:upper:]' '[:lower:]')
+    case "$LOWER_URL" in
       *.yaml|*.yml) FORMAT="yaml" ;;
       *)            FORMAT="json" ;;
     esac

package/pipeline/lib/figma-mcp-refresh.sh

@@ -44,16 +44,20 @@ CLIENT_ID=$(jq -r '.client_id // empty' "$OAUTH_CONFIG")
 CLIENT_SECRET=$(jq -r '.client_secret // empty' "$OAUTH_CONFIG")
 [ -n "$CLIENT_ID" ] || { say "figma-mcp-refresh: client_id missing in .figma-oauth.json"; exit 2; }
 
-CURL_ARGS=(
-  --data-urlencode "grant_type=refresh_token"
-  --data-urlencode "refresh_token=${REFRESH_TOKEN}"
-  --data-urlencode "client_id=${CLIENT_ID}"
-)
-[ -n "$CLIENT_SECRET" ] && CURL_ARGS+=( --data-urlencode "client_secret=${CLIENT_SECRET}" )
+# Refresh token + client secret go through a curl config fed via process
+# substitution so they never appear in argv (argv is visible to ps).
+refresh_grant_cfg() {
+  printf 'data-urlencode = "grant_type=refresh_token"\n'
+  printf 'data-urlencode = "refresh_token=%s"\n' "$REFRESH_TOKEN"
+  printf 'data-urlencode = "client_id=%s"\n' "$CLIENT_ID"
+  if [ -n "$CLIENT_SECRET" ]; then
+    printf 'data-urlencode = "client_secret=%s"\n' "$CLIENT_SECRET"
+  fi
+}
 
 RESPONSE=$(curl -s --max-time 20 -X POST "$TOKEN_ENDPOINT" \
   -H "Content-Type: application/x-www-form-urlencoded" \
-  "${CURL_ARGS[@]}")
+  -K <(refresh_grant_cfg))
 
 NEW_ACCESS=$(printf '%s' "$RESPONSE" | jq -r '.access_token // empty' 2>/dev/null || true)
 NEW_REFRESH=$(printf '%s' "$RESPONSE" | jq -r '.refresh_token // empty' 2>/dev/null || true)
@@ -65,14 +69,25 @@ if [ -z "$NEW_ACCESS" ]; then
   exit 1
 fi
 
+# Keychain write: the add-generic-password command is fed to `security -i`
+# over stdin instead of the direct `security add-generic-password -w <secret>`
+# argv form, so the secret never shows up in process listings. printf is a
+# bash builtin, so no argv exposure there either. Attributes match the
+# previous direct call (-T "" -U). Figma tokens are URL-safe, so embedding in
+# the quoted command string is safe.
+save_keychain_secret() {
+  local service="$1" secret="$2"
+  security delete-generic-password -s "$service" -a "$ACCOUNT" >/dev/null 2>&1 || true
+  printf 'add-generic-password -U -s "%s" -a "%s" -T "" -w "%s"\n' \
+    "$service" "$ACCOUNT" "$secret" | security -i >/dev/null
+}
+
 # Save new access token first, then the rotated refresh token  -  order matters so a
 # mid-write failure never leaves us with a lost refresh token AND a stale access token.
-security delete-generic-password -s "$KEY_NAME" -a "$ACCOUNT" >/dev/null 2>&1 || true
-security add-generic-password -s "$KEY_NAME" -a "$ACCOUNT" -w "$NEW_ACCESS" -T "" -U
+save_keychain_secret "$KEY_NAME" "$NEW_ACCESS"
 
 if [ -n "$NEW_REFRESH" ]; then
-  security delete-generic-password -s "$REFRESH_KEY" -a "$ACCOUNT" >/dev/null 2>&1 || true
-  security add-generic-password -s "$REFRESH_KEY" -a "$ACCOUNT" -w "$NEW_REFRESH" -T "" -U
+  save_keychain_secret "$REFRESH_KEY" "$NEW_REFRESH"
 fi
 
 say "figma-mcp-refresh: renewed '$KEY_NAME' (expires_in=${EXPIRES_IN}s, refresh $( [ -n "$NEW_REFRESH" ] && echo rotated || echo unchanged ))"

package/pipeline/lib/figma-screenshot.sh

@@ -42,7 +42,14 @@ set -euo pipefail
 # --- Globals ----------------------------------------------------------------
 
 PREFS="$HOME/.claude/multi-agent-preferences.json"
-CRED_STORE="$HOME/.claude/lib/credential-store.sh"
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# The helper is optional here: the FIGMA_PAT env fallback still applies when
+# no helper is installed, so a resolver miss must not abort the script.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || true
+CRED_STORE="${CRED_STORE:-}"
 FIGMA_API="https://api.figma.com/v1"
 PARALLEL_DL=4
 HTTP_TIMEOUT=60
@@ -170,9 +177,11 @@ curl_figma() {
   local out="$1" url="$2"
   local code attempt sleep_s
   for attempt in 1 2 3; do
+    # Token header goes through a curl config via process substitution so it
+    # never appears in argv (argv is visible to ps).
     code=$(curl -sS -o "$out" -w '%{http_code}' \
               --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
-              -H "X-Figma-Token: $FIGMA_TOKEN" \
+              -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
               "$url" || echo "000")
     case "$code" in
       2*) printf '%s' "$code"; return 0 ;;

package/pipeline/lib/issue-fetcher.sh

@@ -49,11 +49,21 @@ PROMPT_LANG="${PROMPT_LANG:-tr}"
 detect_kind() {
   local in="$1"
   case "$in" in
-    *atlassian.net/browse/*|*jira*/browse/*|http*://*/browse/*) echo "jira-url" ;;
-    *github.com/*/issues/*) echo "gh-url" ;;
-    [A-Z]*-[0-9]*) echo "jira-id" ;;
+    *atlassian.net/browse/*|*jira*/browse/*|http*://*/browse/*) echo "jira-url"; return ;;
+    *github.com/*/issues/*) echo "gh-url"; return ;;
+    [A-Z]*-[0-9]*) echo "jira-id"; return ;;
+  esac
+  # Bare issue number ("316" or "#316") must resolve BEFORE the repo#N glob:
+  # `*\#[0-9]*` also matches "#316" with an empty repo prefix, which used to
+  # misroute it to gh-short and build https://github.com/<owner>//issues/316.
+  local num="${in#\#}"
+  case "$num" in
+    "") ;;
+    *[!0-9]*) ;;
+    *) echo "gh-num"; return ;;
+  esac
+  case "$in" in
     *\#[0-9]*) echo "gh-short" ;;
-    [0-9]*) echo "gh-num" ;;
     *) echo "freetext" ;;
   esac
 }
@@ -87,19 +97,34 @@ branch_for() {
 }
 
 # --- Provider fetchers (return raw JSON or empty) -----------------------------
+
+# Bearer-auth via a curl config fed through process substitution so the
+# token never appears in argv (argv is visible to `ps` / process audit).
+jira_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$1"; }
+
 fetch_jira() {
   local key="$1"
   if [ -z "$JIRA_HOST" ] || [ -z "$JIRA_TOKEN_KEY" ]; then
     echo "ERR: ACCOUNT_JIRA_HOST and ACCOUNT_JIRA_TOKEN_KEY must be set" >&2
     return 1
   fi
+  # Resolve the credential helper via the shared resolver (works from the
+  # repo checkout and from both install trees)  -  never hardcode the path.
+  # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
+  if [ -z "${CRED_STORE:-}" ]; then
+    # shellcheck disable=SC1090,SC1091
+    . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
+      || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+      || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+      || { echo "ERR: credential helper not found" >&2; return 1; }
+  fi
   local token
-  token=$("$HOME/.claude/lib/credential-store.sh" get "$JIRA_TOKEN_KEY" 2>/dev/null || true)
+  token=$("$CRED_STORE" get "$JIRA_TOKEN_KEY" 2>/dev/null || true)
   if [ -z "$token" ]; then
     echo "ERR: Jira token not found in credential store ($JIRA_TOKEN_KEY)" >&2
     return 1
   fi
-  curl -sf -H "Authorization: Bearer $token" \
+  curl -sf -K <(jira_auth_cfg "$token") \
     "https://$JIRA_HOST/rest/api/2/issue/$key?fields=summary,status,issuetype,description,priority,resolution,fixVersions" \
     || { echo "ERR: Jira fetch failed for $key" >&2; return 1; }
 }

package/pipeline/lib/multi-repo-pipeline.sh

@@ -81,11 +81,15 @@ cmd_prepare() {
 }
 
 cmd_commit() {
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  # Process substitution (not a pipe) so the `failed` counter survives the
+  # loop  -  a piped `while` runs in a subshell and the summary exit would
+  # always be 0 regardless of per-repo failures.
+  local failed=0
+  while IFS=$'\t' read -r name url provider; do
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
     cd "$target"
-    # Use status --porcelain so untracked files count as "changes" too  - 
+    # Use status --porcelain so untracked files count as "changes" too  -
     # dev sessions usually add brand-new files alongside edits, and `git diff`
     # alone misses them.
     if [ -z "$(git status --porcelain 2>/dev/null)" ]; then
@@ -98,30 +102,45 @@ cmd_commit() {
     [ -n "$ISSUE_KEY" ] && subject="$subject [$ISSUE_KEY]"
     # Trim subject to 72 chars
     subject=$(printf '%s' "$subject" | cut -c1-72)
-    git commit --quiet -m "$subject" || true
+    if git commit --quiet -m "$subject"; then
+      echo "[$name] committed: $subject"
+    else
+      echo "ERR: [$name] commit failed" >&2
+      failed=$((failed + 1))
+    fi
     cd - >/dev/null
-    echo "[$name] committed: $subject"
-  done
+  done < <(list_repos_jq)
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: commit failed in $failed repo(s)" >&2
+    return 3
+  fi
 }
 
 cmd_push() {
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  local failed=0
+  while IFS=$'\t' read -r name url provider; do
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
     cd "$target"
-    git push --quiet -u origin "$BRANCH" || echo "[$name] push failed"
+    if git push --quiet -u origin "$BRANCH"; then
+      echo "[$name] pushed $BRANCH"
+    else
+      echo "ERR: [$name] push failed" >&2
+      failed=$((failed + 1))
+    fi
     cd - >/dev/null
-    echo "[$name] pushed $BRANCH"
-  done
+  done < <(list_repos_jq)
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: push failed in $failed repo(s)" >&2
+    return 3
+  fi
 }
 
 cmd_pr() {
   # Open PR for extras first, then primary with cross-links.
-  local primary_name primary_owner_repo
+  local primary_name failed=0
   primary_name=$(python3 -c "import json; d=json.load(open('$STATE')); print(d['primary']['name'])")
-  # Extra-repo PR URLs are passed to the primary PR via the _prs.log file below,
-  # not a shell var  -  the loop runs in a pipe subshell, so any accumulated var
-  # would be lost. The file-based handoff is intentional.
+  # Extra-repo PR URLs are passed to the primary PR via the _prs.log file below.
   while IFS=$'\t' read -r name url provider; do
     if [ "$name" = "$primary_name" ]; then continue; fi
     local target="$WORKTREE_ROOT/$name"
@@ -130,8 +149,16 @@ cmd_pr() {
     if [ "$provider" = "github" ] && command -v gh >/dev/null 2>&1; then
       local body="Ref: $ISSUE_KEY
 Part of multi-repo task $TASK_ID."
-      gh pr create --title "$COMMIT_TYPE($name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null \
-        | tee -a "$WORKTREE_ROOT/_prs.log" || echo "[$name] gh pr create failed"
+      # Capture output first: in `gh ... | tee ... || echo failed` the `||`
+      # binds to tee, so a gh failure was silently reported as success.
+      local pr_out
+      if pr_out=$(gh pr create --title "$COMMIT_TYPE($name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null); then
+        printf '%s\n' "$pr_out" | tee -a "$WORKTREE_ROOT/_prs.log"
+        echo "[$name] PR created"
+      else
+        echo "ERR: [$name] gh pr create failed" >&2
+        failed=$((failed + 1))
+      fi
     else
       echo "[$name] PR creation skipped (provider=$provider)"
     fi
@@ -147,17 +174,54 @@ Part of multi-repo task $TASK_ID."
   local body="Ref: $ISSUE_KEY
 $extras_links"
   if command -v gh >/dev/null 2>&1; then
-    gh pr create --title "$COMMIT_TYPE($primary_name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null \
-      || echo "[$primary_name] gh pr create failed"
+    if gh pr create --title "$COMMIT_TYPE($primary_name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null; then
+      echo "[$primary_name] PR created"
+    else
+      echo "ERR: [$primary_name] gh pr create failed" >&2
+      failed=$((failed + 1))
+    fi
   fi
   cd - >/dev/null
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: PR creation failed for $failed repo(s)" >&2
+    return 3
+  fi
 }
 
+# Resolve a directory to its physical path ("" when it does not resolve).
+resolve_dir() { (cd "$1" 2>/dev/null && pwd -P); }
+
 cmd_teardown() {
-  if [ -d "$WORKTREE_ROOT" ]; then
-    echo "[teardown] removing $WORKTREE_ROOT (logs preserved at ~/.claude/logs/multi-agent/$TASK_ID/)"
-    rm -rf "$WORKTREE_ROOT"
+  if [ ! -d "$WORKTREE_ROOT" ]; then
+    echo "[teardown] nothing to remove ($WORKTREE_ROOT not a directory)"
+    return 0
+  fi
+  # Guard the rm -rf: worktreeRoot comes from state.json, so a corrupted or
+  # malicious value ("." / ".." / "~") must never delete the project, the
+  # home directory, or the filesystem root. Resolve the physical path and
+  # refuse when it equals or contains the current project root or $HOME.
+  local rp cwd home_rp
+  rp=$(resolve_dir "$WORKTREE_ROOT") || rp=""
+  cwd=$(pwd -P)
+  home_rp=$(resolve_dir "$HOME") || home_rp="$HOME"
+  if [ -z "$rp" ] || [ "$rp" = "/" ] || [ "$rp" = "$home_rp" ] || [ "$rp" = "$cwd" ]; then
+    echo "ERR: refusing teardown  -  unsafe worktreeRoot '$WORKTREE_ROOT' (resolved: '${rp:-unresolvable}')" >&2
+    return 4
   fi
+  case "$cwd/" in
+    "$rp"/*)
+      echo "ERR: refusing teardown  -  '$rp' contains the current project root" >&2
+      return 4
+      ;;
+  esac
+  case "$home_rp/" in
+    "$rp"/*)
+      echo "ERR: refusing teardown  -  '$rp' contains the home directory" >&2
+      return 4
+      ;;
+  esac
+  echo "[teardown] removing $rp (logs preserved at ~/.claude/logs/multi-agent/$TASK_ID/)"
+  rm -rf "$rp"
 }
 
 # Emit agent-state.json v2.1.0 from picker state.json so Phase 0 can consume it directly.

package/pipeline/lib/plan-todos.sh

@@ -61,7 +61,10 @@ resolve_state() {
 
 write_state() {
   local path="$1" content="$2"
-  local tmp; tmp=$(mktemp)
+  # mktemp NEXT TO the target: a $TMPDIR temp file can live on a different
+  # filesystem than $HOME, where mv degrades to copy+unlink and loses the
+  # atomic-rename guarantee.
+  local tmp; tmp=$(mktemp "${path}.XXXXXX")
   printf '%s\n' "$content" > "$tmp"
   mv "$tmp" "$path"
 }
@@ -93,6 +96,12 @@ do_set() {
     echo "plan-todos: input must be an object with .title (string) and .todos (array)" >&2
     exit 2
   fi
+  # Per-item validation: every todo needs a string .id and .task, otherwise
+  # downstream jq like `.id + "\t" + .task` crashes on (null + string).
+  if ! jq -e '.todos | all(type == "object" and (.id | type == "string") and (.task | type == "string"))' <<<"$plan_blob" >/dev/null 2>&1; then
+    echo "plan-todos: every todo must be an object with string .id and .task fields" >&2
+    exit 2
+  fi
   local state_path; state_path=$(resolve_state "$task_id")
   local now; now=$(iso_now)
   local new
@@ -209,7 +218,7 @@ do_next() {
           )
       )
     | (.[0] // empty)
-    | if . == null or . == "" then "" else .id + "\t" + .task end
+    | if . == null or . == "" then "" else (.id // "") + "\t" + (.task // "") end
   ' "$state_path"
 }
 
@@ -229,7 +238,7 @@ do_list() {
           skipped:    "- [/]",
           failed:     "- [!]"
         } as $marks
-        | ($marks[.status] // "- [ ]") + " **" + .id + "** " + .task
+        | ($marks[.status] // "- [ ]") + " **" + (.id // "") + "** " + (.task // "")
           + (if (.notes // "") != "" then "  _(" + .notes + ")_" else "" end)
           + (if (.failureReason // "") != "" then "  _**failed:** " + .failureReason + "_" else "" end)
           + (if (.skipReason    // "") != "" then "  _**skipped:** "    + .skipReason    + "_" else "" end))

package/pipeline/lib/post-pr-review.sh

@@ -75,9 +75,11 @@ ITERATION=$(jq -r '.review.iterationNumber // 1' "$AGENT_STATE")
 # --- Decision ---------------------------------------------------------------
 
 # Single jq pass  -  group accepted findings by severity into tab-separated counts.
+# `.review.findings // []` so a null/absent findings array (clean review)
+# cannot raise "Cannot iterate over null" under set -e.
 read -r ACCEPTED_BLOCKING ACCEPTED_IMPORTANT < <(
   jq -r '
-    [.review.findings[] | select(.status == "accepted")] as $a
+    [(.review.findings // [])[] | select(.status == "accepted")] as $a
     | [($a | map(select(.severity == "blocking")) | length),
        ($a | map(select(.severity == "important")) | length)]
     | @tsv
@@ -242,7 +244,7 @@ post_github() {
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
-    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    jq -c '(.review.findings // [])[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
     | while read -r finding; do
         local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body fingerprint
         IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(
@@ -333,7 +335,7 @@ post_bitbucket_server() {
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
-    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    jq -c '(.review.findings // [])[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
     | while read -r finding; do
         local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body payload http fingerprint
         IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(

package/pipeline/lib/repo-cache.sh

@@ -59,6 +59,36 @@ if [ $REFRESH -eq 0 ] && cache_fresh; then
   exit 0
 fi
 
+# Refresh staging: providers write to $CACHE_TMP, then commit_cache validates
+# and mv's it into place. Writing straight to $CACHE_FILE truncated the cache
+# BEFORE the fetch ran, so any failure left an empty file that cache_fresh
+# then served for the whole TTL.
+CACHE_TMP="${CACHE_FILE}.tmp.$$"
+cleanup_tmp() { rm -f "$CACHE_TMP" "$CACHE_TMP.list" 2>/dev/null || true; }
+trap cleanup_tmp EXIT
+
+# Validate the staged file (non-empty valid JSON) and move it into place.
+# On failure keep the previous cache and serve it with a warning; hard-fail
+# only when there is no previous cache to fall back to.
+commit_cache() {
+  if [ -s "$CACHE_TMP" ] \
+    && python3 -c 'import json,sys; json.load(open(sys.argv[1]))' "$CACHE_TMP" 2>/dev/null; then
+    mv "$CACHE_TMP" "$CACHE_FILE"
+    return 0
+  fi
+  rm -f "$CACHE_TMP"
+  if [ -f "$CACHE_FILE" ]; then
+    echo "WARN: repo-cache refresh failed for $PROVIDER/$SCOPE; serving previous cache" >&2
+    return 0
+  fi
+  echo "ERR: repo-cache refresh failed for $PROVIDER/$SCOPE and no previous cache exists" >&2
+  exit 3
+}
+
+# Basic-auth via a curl config fed through process substitution so the
+# credential never appears in argv (argv is visible to `ps`).
+bb_auth_cfg() { printf 'user = "%s:%s"\n' "$1" "$2"; }
+
 case "$PROVIDER" in
   github)
     if ! command -v gh >/dev/null 2>&1; then
@@ -100,20 +130,32 @@ for r in data:
       "provider": "github"
     })
 print(json.dumps(out))
-' > "$CACHE_FILE"
+' > "$CACHE_TMP" || true
+    commit_cache
     ;;
 
   bitbucket)
     : "${BB_TOKEN_KEY:?BB_TOKEN_KEY required for bitbucket}"
     : "${BB_HOST:?BB_HOST required (e.g. bitbucket.example.com)}"
-    BB_USER="${BB_USER:-${BB_USER_KEY:+$("$HOME/.claude/lib/credential-store.sh" get "$BB_USER_KEY" 2>/dev/null || true)}}"
-    BB_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$BB_TOKEN_KEY" 2>/dev/null || true)
+    # Resolve the credential helper via the shared resolver (works from the
+    # repo checkout and from both install trees)  -  never hardcode the path.
+    # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
+    if [ -z "${CRED_STORE:-}" ]; then
+      # shellcheck disable=SC1090,SC1091
+      . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
+        || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+        || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+        || { echo "ERR: credential helper not found" >&2; exit 3; }
+    fi
+    BB_USER="${BB_USER:-${BB_USER_KEY:+$("$CRED_STORE" get "$BB_USER_KEY" 2>/dev/null || true)}}"
+    BB_TOKEN=$("$CRED_STORE" get "$BB_TOKEN_KEY" 2>/dev/null || true)
     if [ -z "$BB_TOKEN" ]; then
       echo "ERR: bitbucket token not found in credential store ($BB_TOKEN_KEY)" >&2
       exit 3
     fi
     # Bitbucket Server REST: /rest/api/1.0/projects/{key}/repos?limit=200
-    curl -sf -u "${BB_USER:-bot}:${BB_TOKEN}" \
+    # Auth via curl config file (-K) so the token never appears on argv.
+    curl -sf -K <(bb_auth_cfg "${BB_USER:-bot}" "$BB_TOKEN") \
       "https://${BB_HOST}/rest/api/1.0/projects/${SCOPE}/repos?limit=200" \
       | python3 -c '
 import json,sys
@@ -147,7 +189,8 @@ for r in vals:
       "provider": "bitbucket"
     })
 print(json.dumps(out))
-' > "$CACHE_FILE"
+' > "$CACHE_TMP" || true
+    commit_cache
     ;;
 
   local)
@@ -161,7 +204,7 @@ print(json.dumps(out))
     if [ -d "$SCOPE" ]; then
       ROOTS="$SCOPE"
     fi
-    : > "$CACHE_FILE.tmp"
+    : > "$CACHE_TMP.list"
     for root in $ROOTS; do
       [ -d "$root" ] || continue
       # -prune avoids descending into already-found .git trees (nested submodules
@@ -178,7 +221,7 @@ print(json.dumps(out))
             # truly offline-only or a clone with an upstream we just chose
             # to treat as local.
             remote=$(git -C "$repo_dir" remote get-url origin 2>/dev/null || true)
-            printf '%s\t%s\t%s\n' "$name" "$repo_dir" "$remote" >> "$CACHE_FILE.tmp"
+            printf '%s\t%s\t%s\n' "$name" "$repo_dir" "$remote" >> "$CACHE_TMP.list"
           done
     done
     python3 -c '
@@ -218,8 +261,9 @@ for raw in open(sys.argv[1]):
         "provider": "local"
     })
 print(json.dumps(out))
-' "$CACHE_FILE.tmp" > "$CACHE_FILE"
-    rm -f "$CACHE_FILE.tmp"
+' "$CACHE_TMP.list" > "$CACHE_TMP" || true
+    rm -f "$CACHE_TMP.list"
+    commit_cache
     ;;
 
   *)